iproute, libpng, postgresql, IPSec, imlib, ruby, ncompress, and mod_ssl.
Red Hat, and TurboLinux.
The first thing to always note is when your machine was rebooted.
Since Linux is a robust and stable OS, the only times your machine
should reboot is when you take it down for OS upgrades, hardware
swapping, or the like. If your machine has rebooted without you
doing it, that may be a sign that an intruder has compromised it.
Many of the ways that your machine can be compromised require the
intruder to reboot or power off your machine.
Check for signs of tampering on the case and computer area. Although
many intruders clean traces of their presence out of logs, it’s a
good idea to check through them all and note any discrepancy.
| |
Debian |
| |
Debian: zgv arbitrary code execution
fix |
| |
14th, December, 2004
Several vulnerabilities have been discovered in zgv, an SVGAlib
graphics viewer for the i386 architecture.
http://www.linuxsecurity.com/content/view/117475 |
| |
| |
Debian: atari800 local root exploit fix |
| |
14th, December, 2004
Adam Zabrocki discovered multiple buffer overflows in atari800,
an Atari emulator. In order to directly access graphics hardware, one
of the affected programs is installed setuid root. A local attacker could
exploit this vulnerability to gain root privileges.
http://www.linuxsecurity.com/content/view/117492 |
| |
| |
Fedora |
| |
Fedora: MyODBC-2.50.39-18.2 update |
| |
10th, December, 2004
This update fixes a problem that occurs when the user’s locale
setting selects a decimal point other than “.”.
http://www.linuxsecurity.com/content/view/117469 |
| |
| |
Fedora: MyODBC-2.50.39-19.1 update |
| |
10th, December, 2004
This update fixes a problem that occurs when the user’s locale
setting selects a decimal point other than “.”.
http://www.linuxsecurity.com/content/view/117470 |
| |
| |
Fedora: mikmod-3.1.6-30.2 update |
| |
13th, December, 2004
This moves ‘mikmod’ back to the main package. It was incorrectly
in the mikmod-devel package.
http://www.linuxsecurity.com/content/view/117476 |
| |
| |
Fedora: gstreamer-0.8.7-4.FC3.0 update |
| |
14th, December, 2004
This update adds multilib support to GStreamer; this fixes several
issues people had on multilib architectures such as x86_64. It’s been
fairly well tested but please do not hesitate to report any issues.
http://www.linuxsecurity.com/content/view/117494 |
| |
| |
Fedora: grep-2.5.1-31.2 update |
| |
14th, December, 2004
This update improves performance when processing UTF-8 input.
http://www.linuxsecurity.com/content/view/117495 |
| |
| |
Fedora: flim-1.14.7-0.FC2 update |
| |
15th, December, 2004
Update to 1.14.7 release, which also fixes CAN-2004-0422.
http://www.linuxsecurity.com/content/view/117518 |
| |
| |
Fedora: kdelibs-3.2.2-10.FC2 update |
| |
15th, December, 2004
apply the patch to fix Konqueror Window Injection Vulnerability
#142510 CAN-2004-1158, Thanks to KDE security team
http://www.linuxsecurity.com/content/view/117519 |
| |
| |
Fedora: kdebase-3.2.2-8.FC2 update |
| |
15th, December, 2004
apply the patch to fix Konqueror Window Injection Vulnerability
#142510 CAN-2004-1158, Thanks to KDE security team
http://www.linuxsecurity.com/content/view/117520 |
| |
| |
Fedora: kdelibs-3.3.1-2.4.FC3 update |
| |
15th, December, 2004
apply the patch to fix Konqueror Window Injection Vulnerability
#142510 CAN-2004-1158, Thanks to KDE security team
http://www.linuxsecurity.com/content/view/117521 |
| |
| |
Fedora: kdebase-3.3.1-4.3.FC3 update |
| |
15th, December, 2004
apply the patch to fix Konqueror Window Injection Vulnerability
#142510 CAN-2004-1158, Thanks to KDE security team
http://www.linuxsecurity.com/content/view/117522 |
| |
| |
Fedora: selinux-policy-targeted-1.17.30-2.51
update |
| |
16th, December, 2004
Fix problems with winbind, nscd, apache and others.
http://www.linuxsecurity.com/content/view/117525 |
| |
| |
Fedora: xcdroast-0.98a15-8 update |
| |
16th, December, 2004
fixed frozen progress bars with patch from Didier Heyden (bug
#134334)
http://www.linuxsecurity.com/content/view/117529 |
| |
| |
Fedora: udev-039-10.FC3.6 update |
| |
16th, December, 2004
fixed a case where reading /proc/ide/hd?/media returns EIO (bug
rh#142713) and added simple dvb rules
http://www.linuxsecurity.com/content/view/117530 |
| |
| |
Gentoo |
| |
Gentoo: PHProjekt setup.php vulnerability |
| |
10th, December, 2004
PHProjekt contains a vulnerability in the setup procedure allowing
remote users without admin rights to change the configuration.
http://www.linuxsecurity.com/content/view/117468 |
| |
| |
Gentoo: nfs-utils Multiple remote vulnerabilities |
| |
13th, December, 2004
Multiple vulnerabilities have been discovered in nfs-utils that
could lead to a Denial of Service, or the execution of arbitrary code.
http://www.linuxsecurity.com/content/view/117478 |
| |
| |
Gentoo |
| |
Gentoo: ncpfs Buffer overflow in ncplogin
and ncpmap |
| |
15th, December, 2004
ncpfs is vulnerable to a buffer overflow that could lead to
local execution of arbitrary code with elevated privileges.
http://www.linuxsecurity.com/content/view/117505 |
| |
| |
Gentoo: vim, gVim Vulnerable options
in modelines |
| |
15th, December, 2004
Several vulnerabilities related to the use of options in modelines
have been found and fixed in Vim. They could potentially result in a local
user escalating privileges.
http://www.linuxsecurity.com/content/view/117508 |
| |
| |
Mandrake |
| |
Mandrake: evolution various bugs fix |
| |
14th, December, 2004
This update provides Evolution 2.0.3 which fixes a number of
bugs found in the previous version of Evolution, including the possibility
to lose mail when Evolution sends an email message, that fails to send,
but Evolution doesn’t realize it has failed.
http://www.linuxsecurity.com/content/view/117484 |
| |
| |
Mandrake: mdkonline provide new features |
| |
14th, December, 2004
This is a major update of mandrakeonline which fixes several
issues and adds more features such as a text wizard for servers without
Xwindow capabilities, support for server products, corporate and MNF for
instance, errors displaying and md5sum file checks.
http://www.linuxsecurity.com/content/view/117485 |
| |
| |
Mandrake: iproute2 temporary file vulnerability |
| |
14th, December, 2004
Herbert Xu discovered that iproute can accept spoofed messages
sent via the kernel netlink interface by other users on the local machine.
This could lead to a local Denial of Service attack.
http://www.linuxsecurity.com/content/view/117486 |
| |
| |
Mandrake: evolution various bugs fix |
| |
14th, December, 2004
This update provides Evolution 2.0.3 which fixes a number of
bugs found in the previous version of Evolution, including the possibility
to lose mail when Evolution sends an email message, that fails to send,
but Evolution doesn’t realize it has failed.
http://www.linuxsecurity.com/content/view/117487 |
| |
| |
Mandrake: libpng invalid zlib header
problem fix |
| |
14th, December, 2004
A problem in version 1.2.6 of the libpng library would cause
libpng to write an invalid zlib header within the PNG datastream. This
can cause some applications to display the images incorrectly.
http://www.linuxsecurity.com/content/view/117488 |
| |
| |
Mandrake: postgresql temporary file vulnerability
fix |
| |
14th, December, 2004
The Trustix development team found insecure temporary file creation
problems in a script included in the postgresql package. This could allow
an attacker to trick a user into overwriting arbitrary files he has access
to.
http://www.linuxsecurity.com/content/view/117489 |
| |
| |
Mandrake: kde various bug fixes |
| |
15th, December, 2004
A number of KDE-related packages are being released to address
a number of bugs in these packages. Updated packages include kdenetwork
(which fixes problems in kget, kopete, and krfb), kdepim (which fixes
problems in kmail, knode, knotes, and kontact), kwallet (which fixes problems
in kwalleditor and kcmlirc), and kdesdk (which fixes a problem in cervisia).
http://www.linuxsecurity.com/content/view/117516 |
| |
| |
Mandrake: kdelibs & kdebase vulnerability
fix |
| |
15th, December, 2004
Daniel Fabian discovered a potential privacy issue in KDE. When
creating a link to a remote file from various applications, including
Konqueror, the resulting URL may contain the authentication credentials
used to access that remote resource. This includes, but is not limited
to, browsing SMB (Samba) shares. Upon further investigation, it was found
that the SMB protocol handler also unnecessarily exposed authentication
credentials (CAN-2004-1171).
http://www.linuxsecurity.com/content/view/117517 |
| |
| |
OpenBSD: kernel heap overflow in IPsec |
| |
14th, December, 2004
On systems running isakmpd(8) it is possible for a local user
to cause kernel memory corruption and system panic by setting ipsec(4)
credentials on a socket. Stopping isakmpd(8) does not prevent the memory
corruption.
http://www.linuxsecurity.com/content/view/117493 |
| |
| |
Red Hat: imlib security vulnerabilities
fix |
| |
10th, December, 2004
Updated imlib packages that fix several integer and buffer overflows
are now available.
http://www.linuxsecurity.com/content/view/117455 |
| |
| |
Red Hat: ruby denial of service issue
fix |
| |
13th, December, 2004
An updated ruby package that fixes a denial of service issue
for the CGI instance is now available.
http://www.linuxsecurity.com/content/view/117479 |
| |
| |
Red
Hat |
| |
Red Hat: ncompress security issue and
bug fix |
| |
13th, December, 2004
An updated ncompress package that fixes a buffer overflow and
problem in the handling of files larger than 2 GB is now available.
http://www.linuxsecurity.com/content/view/117480 |
| |
| |
Red Hat: apache and mod_ssl security
vulnerabilities fix |
| |
13th, December, 2004
Updated apache and mod_ssl packages that fix various minor security
issues and bugs in the Apache Web server are now available for Red Hat
Enterprise Linux 2.1.
http://www.linuxsecurity.com/content/view/117481 |
| |
| |
Red Hat: kernel security vulnerability
fix |
| |
13th, December, 2004
Updated kernel packages are now available as part of ongoing
support and maintenance of Red Hat Enterprise Linux version 2.1. This
is the sixth regular update.
http://www.linuxsecurity.com/content/view/117482 |
| |
| |
Red Hat: Itanium security issues fix |
| |
13th, December, 2004
Updated Itanium kernel packages are now available as part of
ongoing support and maintenance of Red Hat Enterprise Linux version 2.1.
This is the sixth regular update.
http://www.linuxsecurity.com/content/view/117483 |
| |
| |
TurboLinux |
| |
TurboLinux: Security & Bugfix |
| |
13th, December, 2004
Numerous issues in the Linux ELF binary loader. Issues relating
to IDE DMA transfers which prevent installation on machines with SiS chipsets
using the SiS 962/963 IDE controller. Null pointer dereferencing in the
SG driver.
http://www.linuxsecurity.com/content/view/117471 |
| |
| |
